Search stories, models, companies…
Subscribe

Popular topics

OpenAI83Anthropic81Google Gemini45Claude Code27Coding agents51Model Context Protocol (MCP)13
The week in AI, in one email.
Topic · Concept

Security

Security covers attacks on AI systems, attacks that use AI, and the plain cyberattacks that hit the software and devices AI runs on. As agents gain access to email, code, browsers and company data, the cost of a single mistake or a single hijacked model grows.

45 stories · updated Oct 18
Follow via RSSGet Security alerts

Key facts

Checked Oct 13
OWASP Top 10 for LLM applications (2025)
Prompt injection ranked first (LLM01)
Midnight Mimosa firmware malware report
October 8, 2026 (Bitdefender Labs)

Latest on Security

Policy · NewsCERT-In AI agents advisory: India says unnamed AI providers' agents reached live systems, as Tencent admits unintended agent browsingIndia's CERT-In issued a critical advisory on October 15, 2026, saying AI agents under evaluation reached live systems of Indian organizations, based on voluntary disclosures from AI model providers it didn't name. A day later, Tencent said agents it used to evaluate third-party models showed unintended browsing behavior on Alibaba's Amap.·7 min readDevelopers · GuideHow to detect and block AI agents on your website: what CERT-In, OpenAI, Anthropic, Google and Cloudflare documentHow to detect and block AI agents on your website, using only official guidance: the user agents, IP lists and signed requests OpenAI, Anthropic and Google publish, Cloudflare's verified-bot controls, and CERT-In's October 15, 2026 advice for agents that don't identify themselves.·6 min readDevelopers · NewsOpenCode breach: provider API keys stored in OpenCode Console may have been exposed. What happened and what to doThe OpenCode breach, disclosed on October 17, 2026, hit about 1.4% of OpenCode Console users who had linked their own OpenAI, Anthropic or Google keys, according to OpenCode's post on X. Here's what's known, who is affected, and how to revoke and replace exposed keys using the providers' own guidance.·7 min readResearch · AnalysisWere the NIST curves backdoored? Claude traced the ECDSA curve seeds to a 1990s random number generatorWere the NIST curves backdoored? On October 16, 2026, Anthropic said Claude found that the unexplained seeds behind P-256 and the other NIST ECDSA curves came from a clock-seeded 1990s random number generator. Cryptographer Filippo Valsorda checked the result. What it rules out, and what's still unexplained.·8 min readDevelopers · NewsPostgres 19 delayed to November 19: what the release team said, and what AI code review had to do with itPostgreSQL 19 is delayed: the release team moved general availability from October 29 to November 19, 2026, and added a second release candidate. A PostgreSQL committer says LLM-assisted code review surfaced defects faster than developers could fix them, contributing to 8 to 10 reverted features. Here's what's confirmed and what the 'AI reviewers' headlines overstate.·6 min readDevelopers · NewsStolen AI API keys are paying for autonomous attack scans, and an Archon flaw exposes AI coding agents: what developers should checkBitsight says criminals are selling MONST3R-AI, an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key's owner pays for the attacks. Separately, CVE-2026-111322 leaves the Archon AI coding agent's control API open without a login by default. What happened, how to check your exposure and what the vendors' guidance says.·8 min readIndustry · AnalysisAI security acquisitions: Proofpoint buys Varonis for $6.3 billion and Cohere moves on AISLE. What the deals sayOn October 15, 2026, Proofpoint agreed to buy Varonis for about $6.3 billion in cash, and Cohere signed a letter of intent to acquire the AI bug-hunting startup AISLE. Together with OpenAI's reported Trail of Bits talks, the AI security acquisitions point to two different bets: securing the data AI agents touch, and owning AI that finds and fixes bugs.·7 min readDevelopers · NewsMicrosoft October 2026 Patch Tuesday: a record 1,400+ CVEs, one exploited Windows Shell zero-day, and what to patch firstMicrosoft's October 2026 Patch Tuesday, released October 13, fixed more than 1,400 CVEs by the count in Microsoft's Security Update Guide, the first four-digit monthly release and a record for the second month running. One Windows Shell bug is under active attack and on CISA's KEV list, and one of its credited finders used Claude.·5 min readOpen source · NewsPoeLLM malware hit thousands of exposed AI servers, including LiteLLM and Ollama: how to check and lock yours downLumen's Black Lotus Labs says the PoeLLM botnet has infected more than 3,400 internet-facing servers since April 2026, many running LiteLLM or Ollama, and reads its command server address from a poem on GitHub. What happened, and how to check and secure your own AI server.·5 min readDevelopers · NewsAnthropic Cyber Mission: free OSS Scanner for open-source projects, a critical infrastructure program and three Cyber Verification tiersOn October 8, 2026, Anthropic launched OSS Scanner, free Claude vulnerability scans for open-source projects, and a Critical Infrastructure Defense Program. Two days earlier it merged Project Glasswing into a three-tier Cyber Verification Program. How each works and how maintainers opt in.·5 min read

Nothing in this format on this page — try another filter or the next page.